Critical MaxKB AI Agent Flaw Lets Prompt Injection Execute System Commands

A critical vulnerability in the MaxKB AI knowledge-base platform could let attackers exploit prompt injection and run operating system commands on vulnerable deployments, including directly on the underlying host in some configurations.

This flaw, tracked as CVE-2026-77521 and GHSA-f36j-f34j-h3rx, affects MaxKB versions up to and including 2.10.3-lts. The issue has received a maximum CVSS v3.1 score of 10.0 for public or embedded assistants that can be accessed without authentication. The patch for this vulnerability is included in MaxKB version 2.10.5-lts.

Critical MaxKB AI Agent Flaw

The vulnerability particularly affects MaxKB assistants configured with a tool, Model Context Protocol (MCP) tool, skill, or sub-application. These configurations route user chats through a deepagents-based agent that utilizes a SandboxShellBackend.

According to the advisory, using that backend with deepagents automatically grants the AI model shell execution capability. The generated agent has access to tools for executing commands, performing file system operations, and searching directories.

While MaxKB does not explicitly exclude the execute tool, its human-in-the-loop controls cover file actions like write_file, read_file, and edit_file, but not command execution.

Consequently, a malicious prompt, or an indirect prompt embedded in a document processed through retrieval-augmented generation (RAG), could lead the model to invoke shell commands.

Researchers from Lasso Security indicated that the issue does not always require a jailbreak. During testing, simple operational commands were sufficient to prompt the agent to execute system-information commands and write the results to a file.

The most significant risk exists in source and bare-metal MaxKB deployments where the MAXKB_SANDBOX setting is not explicitly enabled.

The affected shell backend checks the SANDBOX configuration value and defaults to disabled when the setting is absent. In that case, commands are executed through Python’s subprocess.run() with shell=True, using the application’s host privileges.

This creates a potential path for remote code execution as the MaxKB service account. If the application operates with elevated permissions, an attacker could access credentials and configuration files, probe internal services, move laterally across a network, or establish persistence.

The advisory also warns that multi-tenant deployments could allow for cross-tenant impacts. At the same time, unauthenticated attackers could target publicly exposed assistants.

Furthermore, indirect prompt injection broadens the threat model: an attacker might only need to control content uploaded to or ingested by a MaxKB assistant instead of directly interacting with it.

MaxKB’s official container image enables MAXKB_SANDBOX=1, which attempts to run commands under a lower-privileged sandbox user. However, researchers found that this protection can be bypassed because the command wrapper constructs commands as a shell=True string, which a root shell executes.

Shell metacharacters, including redirects, pipes, command separators, and command substitution, can be interpreted by the outer shell before it passes the command to the lower-privileged process. In testing, a simple redirect allowed for the creation of a root-owned file, even when the command executed under the sandbox user was blocked.

Additionally, the Docker image reportedly lacks a USER directive, meaning it runs as UID 0 by default. This amplifies the impact of any sandbox escape conditions.

Administrators should immediately upgrade to MaxKB version 2.10.5-lts or later. Organizations should also review every assistant connected to tools, MCP integrations, skills, or sub-applications.

Recommended defensive measures include:

• Disable shell-capable agent backends unless code execution is explicitly required.
• Require human approval before any execute action.
• Avoid relying on model alignment as a security boundary against prompt injection.
• Ensure bare-metal deployments fail closed if a secure sandbox is unavailable.
• Run containers as a non-root user and avoid constructing command strings with shell=True.
• Treat RAG documents, uploads, and external content as untrusted inputs.

This flaw is classified under CWE-78 (OS command injection), CWE-250 (execution with unnecessary privileges), and CWE-749 (exposure of dangerous functionality).

Cut every SOC alert investigation by 21 min. Power your SOC with instant IOC context for immediate response: Integrate TI Lookup in your SOC